{"id":"CVE-2026-104659","published":"2026-10-08T11:16:44.013","lastModified":"2026-10-08T21:02:43.860","description":"Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding. The listener, which is off by default and bound to the loopback when enabled, answered requests whatever their Host header named, and a failed sign-in with the administrator's password from the loopback was neither auto-banned nor delayed. A web page whose host name the attacker rebinds to 127.0.0.1, opened in a browser on the server, can therefore send authenticated requests to the listener, read the answers and try administrator passwords at full speed until one is accepted, giving the attacker full administrative control of the mail server.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-346"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6","tags":[]},{"url":"https://gitlab.com/hmailserver/hmailserver/-/work_items/57","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Progressive Robot hMailServer has a critical flaw in its REST API listener that allows remote attackers to brute-force administrator passwords through DNS rebinding attacks. The vulnerability occurs because the server accepts requests regardless of Host header values and doesn't throttle failed login attempts, enabling attackers to send authenticated requests from the victim's browser at full speed.","exploitability":"Exploitation requires DNS rebinding to redirect a web page to 127.0.0.1, with the attacker's page running in the victim's browser that has access to the REST API listener, making it moderately difficult but achievable with a bit of social engineering.","blast_radius":"If exploited, attackers could gain full administrative control over the mail server, potentially compromising all email accounts and data stored on the server.","remediation":"Disable the REST API listener in hMailServer configuration or upgrade to version 6.3.6 or later which fixes this vulnerability.","detection":"Monitor for failed authentication attempts from loopback interface (127.0.0.1) with high frequency and lack of rate limiting, particularly in logs related to REST API access.","tags":["auth-bypass","web","api","dns-rebinding"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:03:50.702Z"}}